Tuesday, September 5, 2017

Imagine that you wake up one day to find out that 13,625 images and videos have disappeared from your iPhone, iPad, and iCloud.com.

This is exactly what happened to my iCloud and specifically iCloud Photo Library. I woke up one day to find out that all of my old images from March 2014 till March 2017 now have disappeared.

I kept refreshing icloud.com/#photos, changing browsers, and researching. The "Deleted Photos" folder was empty. I was screwed.

I even waited a day to check back iCloud.com and still images didn't show up.

Exact thoughts

"Fuck you Apple, literally fuck you". I couldn't process it. I trusted iCloud and I thought my data was safe there but apparently, it wasn't. Those images were important to me and only some images from 2014 were backed up. The rest weren't.

First attempt to contact Apple Support

The first attempt to contact their support was an utter failure. I was barely hearing the support personnel (who was located in Egypt and speaking Arabic). The call disconnected before I articulated my problem and they didn't bother to call me back, they instead sent me this:

An empty email with a header message saying contact us. Not even a body message.

Using forensic tools

At that point, I completely gave up on Apple and I started looking for online help to fix my issue. I found a great forensic tool called Elcomsoft phone breaker for Mac:
What this tool claimed to do was:

"Elcomsoft Phone Breaker can extract photos and videos stored in the user’s iCloud Photo Library. In addition to existing files, Elcomsoft Phone Breaker can extract media files that have been deleted from the Library during the past 30 days. Selective downloads are possible by specifying which user-created albums to download."

Exploring Elcomsoft PhoneBreaker

I was really skeptical about this software so I decided to give it a try, I have turned off two step authentication temporarily and logged in via their program to see this interface:

I was really happy that now my missing images are appearing in "Deleted". On icloud.com, the deleted folder was empty. However, they were being displayed in this software.

Purchasing Elcomsoft PhoneBreaker

At that point, Elcomsoft has proven to be working (by allowing me to recover only up to 10 pictures). I had to purchase the software for USD200.

After a few minutes, I received my registration code:

Starting the Download:

This was the most chaotic part. The download took almost a day despite having an internet speed of 1.5 MB/s. The download has interrupted at least 20 times (due to poor internet connectivity or iCloud issues/restrictions).

However, I realized later that the download is resumable because the pictures are downloaded in chunks inside a hidden folder called.chunks. The contents of the folder look similar to this:

So every time the download interrupted, I re-downloaded it using the same directory that had .chunks, so the download resumed instead of restarting. At the end of the day, I had my images downloaded.

Images had no timestamp

Images were mixed without a date, so they lost they lost their chronological order. I realized that at that point, I have to contact Apple again.

Another attempt to contact Apple

This time I couldn't even submit a request:

Final attempt to contact Apple

The next day, I kept trying to contact support until they managed to call me. This time, finally, I was able to talk to a support technician from Apple. Apple performed their security checks and when they have done that, they have informed me that they will be able to recover them.

Their support was really great.

Images reappear in Recently Deleted

After the call ended, support was able to restore images to "Recently Deleted" but not to "All Photos".

Support attempts to call me again

Only to inform me this time that images have been recovered but they are in the "Recently Deleted" folder and I had no move them back to other folders to prevent the permanent deletion of them in 30 days.

Case Closed

Images have been recovered. I moved on.

So, what caused this?

It is not really known what caused the images to be removed. But I believe, when I have switched from my old to my new mac, I used Apple's Migrate Assistant, which moved the old Macbook data to the new Macbook. Later on, I activated iCloud Photos. So the contents of the Photos app were synced (Which had few images only).

I think that iCloud Photo Library thought that I have removed the images and thus removed them from iCloud Photo Library and consequently all of my devices.

What is the lesson?

Never trust the cloud and specifically iCloud. Your data isn't safe and might be removed forever. Physical encrypted backups for everything are a must.

Final thoughts

It was important to deal with this situation calmly, I will not stop using iCloud Photo Library even though it fucked up; but I will increase my backups with those photos. I have already downloaded Google Photos and I will be allowing the app to store all of those images. I will be also having physical and encrypted backups of those images.